Create withheld permissions

chrome/browser/extensions/active_tab_permission_granter.cc

Index: chrome/browser/extensions/active_tab_permission_granter.cc
diff --git a/chrome/browser/extensions/active_tab_permission_granter.cc b/chrome/browser/extensions/active_tab_permission_granter.cc
index c2d0cd5edd5e9532c41a6d68d8eca6f982374f8c..ac09cb7a012f8e28213fa9a6bf2e016cd0235084 100644
--- a/chrome/browser/extensions/active_tab_permission_granter.cc
+++ b/chrome/browser/extensions/active_tab_permission_granter.cc
@@ -45,19 +45,11 @@ void ActiveTabPermissionGranter::GrantIfRequested(const Extension* extension) {
 
   const PermissionsData* permissions_data = extension->permissions_data();
 
-  // If the extension requires action for script execution, we grant it
+  // If the extension requested all-hosts but has had it withheld, we grant it
   // active tab-style permissions, even if it doesn't have the activeTab
   // permission in the manifest.
-  // We don't take tab id into account, because we want to know if the extension
-  // should require active tab in general (not for the current tab).
-  bool requires_action_for_script_execution =
-      permissions_data->RequiresActionForScriptExecution(extension,
-                                                         -1,  // No tab id.
-                                                         GURL());
-
-  if (extension->permissions_data()->HasAPIPermission(
-          APIPermission::kActiveTab) ||
-      requires_action_for_script_execution) {
+  if (permissions_data->HasAPIPermission(APIPermission::kActiveTab) ||
+      permissions_data->HasWithheldImpliedAllHosts()) {
     URLPattern pattern(UserScript::ValidUserScriptSchemes());
     // Pattern parsing could fail if this is an unsupported URL e.g. chrome://.
     if (pattern.Parse(web_contents()->GetURL().spec()) ==
@@ -67,8 +59,7 @@ void ActiveTabPermissionGranter::GrantIfRequested(const Extension* extension) {
     new_apis.insert(APIPermission::kTab);
   }
 
-  if (extension->permissions_data()->HasAPIPermission(
-          APIPermission::kTabCapture))
+  if (permissions_data->HasAPIPermission(APIPermission::kTabCapture))
     new_apis.insert(APIPermission::kTabCaptureForTab);
 
   if (!new_apis.empty() || !new_hosts.is_empty()) {